Skip to content
OpenAdvisories
High ALAS2023-2026-3267 1 CVE

Important: curl security update (Amazon Linux 2023)

Published Oct 26, 2026 · Updated Oct 26, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2023 that fix the following vulnerabilities: CVE-2026-92392: During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server (with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after free of a `struct Curl_easy` object.

Fixed packages 10

ReleasePackageFixed in
Amazon Linux · 2023 curl 0:8.21.0-5.amzn2023.0.3
Amazon Linux · 2023 curl-debuginfo 0:8.21.0-5.amzn2023.0.3
Amazon Linux · 2023 curl-debugsource 0:8.21.0-5.amzn2023.0.3
Amazon Linux · 2023 curl-minimal 0:8.21.0-5.amzn2023.0.3
Amazon Linux · 2023 curl-minimal-debuginfo 0:8.21.0-5.amzn2023.0.3
Amazon Linux · 2023 libcurl 0:8.21.0-5.amzn2023.0.3
Amazon Linux · 2023 libcurl-debuginfo 0:8.21.0-5.amzn2023.0.3
Amazon Linux · 2023 libcurl-devel 0:8.21.0-5.amzn2023.0.3
Amazon Linux · 2023 libcurl-minimal 0:8.21.0-5.amzn2023.0.3
Amazon Linux · 2023 libcurl-minimal-debuginfo 0:8.21.0-5.amzn2023.0.3

Vulnerabilities 1

  • High 8.1
    CVE-2026-92392 Public exploit

    HTTP/2 upload Use-After-Free

    During an upload, curl mishandles HTTP/2 `RST_STREAM` received from the server (with reason `HTTP_1_1_REQUIRED` or `REFUSED_STREAM`) leading to a use after free of a `struct Curl_easy` object.

    curl curl mysql curl Debian Ubuntu Azure Linux Alpine Wolfi

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-92392.html